    POSTSCREEN(8)                                                    POSTSCREEN(8)

    NAME
           postscreen - Postfix SMTP triage server

    SYNOPSIS
           postscreen [generic Postfix daemon options]

    DESCRIPTION
           The Postfix postscreen(8) server performs triage on multi-
           ple inbound SMTP connections in parallel. While  a  single
           postscreen(8)  process  keeps  spambots  away from Postfix
           SMTP server processes, more Postfix SMTP server  processes
           remain available for legitimate clients.

           postscreen(8)  maintains a temporary whitelist for clients
           that have passed a number of tests.  When an  SMTP  client
           IP  address  is  whitelisted,  postscreen(8) hands off the
           connection immediately to a Postfix SMTP  server  process.
           This minimizes the overhead for legitimate mail.

           By  default,  postscreen(8)  logs statistics and hands off
           every connection to a Postfix SMTP server  process,  while
           excluding clients in mynetworks from all tests (primarily,
           to avoid problems with non-standard  SMTP  implementations
           in  network  appliances).   This  mode  is useful for non-
           destructive testing.

           In a typical production setting, postscreen(8) is  config-
           ured  to  reject  mail  from clients that fail one or more
           tests. postscreen(8) logs rejected mail  with  the  client
           address, helo, sender and recipient information.

           postscreen(8)  is  not an SMTP proxy; this is intentional.
           The purpose is to keep spambots  away  from  Postfix  SMTP
           server processes, while minimizing overhead for legitimate
           traffic.

    SECURITY
           The postscreen(8) server is moderately security-sensitive.
           It  talks to untrusted clients on the network. The process
           can be run chrooted at fixed low privilege.

    STANDARDS
           RFC 5321 (SMTP, including multi-line 220 greetings)
           RFC 2920 (SMTP Pipelining)

    DIAGNOSTICS
           Problems and transactions are logged to syslogd(8).

    BUGS
           Some   of   the   non-default   protocol   tests   involve
           postscreen(8)'s  built-in SMTP protocol engine. When these
           tests succeed, postscreen(8) adds the client to the tempo-
           rary  whitelist but it cannot not hand off the "live" con-
           nection to a Postfix SMTP server process in the middle  of
           a  session.   Instead,  postscreen(8)  defers  attempts to
           deliver mail with a 4XX status, and waits for  the  client
           to  disconnect.   The next time a good client connects, it
           will be allowed to talk to a Postfix SMTP  server  process
           to  deliver  mail.  postscreen(8)  mitigates the impact of
           this limitation by giving such  tests  a  long  expiration
           time.

           The  postscreen(8)  built-in SMTP protocol engine does not
           announce support for STARTTLS, AUTH, XCLIENT  or  XFORWARD
           (support  for  STARTTLS  and  AUTH  may  be  added  in the
           future).  End-user clients should connect directly to  the
           submission  service;  other systems that require the above
           features should directly connect to a Postfix SMTP server,
           or they should be placed on the postscreen(8) whitelist.

    CONFIGURATION PARAMETERS
           Changes  to  main.cf  are  not picked up automatically, as
           postscreen(8) processes may run for  several  hours.   Use
           the command "postfix reload" after a configuration change.

           The text below provides  only  a  parameter  summary.  See
           postconf(5) for more details including examples.

           NOTE:  Some  postscreen(8)   parameters  implement stress-
           dependent behavior.   This  is  supported  only  when  the
           default  value is stress-dependent (that is, it looks like
           ${stress?X}${stress:Y}).  Other parameters always evaluate
           as if the stress value is the empty string.

    TRIAGE PARAMETERS
           postscreen_bare_newline_action (ignore)
                  The  action  that  postscreen(8) takes when an SMTP
                  client sends a bare newline character, that  is,  a
                  newline not preceded by carriage return.

           postscreen_bare_newline_enable (no)
                  Enable  "bare  newline"  SMTP protocol tests in the
                  postscreen(8) server.

           postscreen_blacklist_action (ignore)
                  The action that postscreen(8) takes  when  an  SMTP
                  client   is   permanently   blacklisted   with  the
                  postscreen_blacklist_networks parameter.

           postscreen_blacklist_networks (empty)
                  Network addresses that are permanently blacklisted;
                  see  the  postscreen_blacklist_action parameter for
                  possible actions.

           postscreen_disable_vrfy_command ($disable_vrfy_command)
                  Disable the SMTP VRFY command in the  postscreen(8)
                  daemon.

           postscreen_dnsbl_action (ignore)
                  The  action  that  postscreen(8) takes when an SMTP
                  client's  combined  DNSBL  score  is  equal  to  or
                  greater  than  a  threshold  (as  defined  with the
                  postscreen_dnsbl_sites and postscreen_dnsbl_thresh-
                  old parameters).

           postscreen_dnsbl_reply_map (empty)
                  A  mapping  from  actual  DNSBL  domain  name which
                  includes a secret password,  to  the  DNSBL  domain
                  name  that  postscreen  will  reply  with  when  it
                  rejects mail.

           postscreen_dnsbl_sites (empty)
                  Optional list of DNS blocklist domains, filters and
                  weight factors.

           postscreen_dnsbl_threshold (1)
                  The  inclusive  lower  bound  for  blocking an SMTP
                  client,  based  on  its  combined  DNSBL  score  as
                  defined  with the postscreen_dnsbl_sites parameter.

           postscreen_forbidden_commands ($smtpd_forbidden_commands)
                  List of commands that the postscreen(8) server con-
                  siders in violation of the SMTP protocol.

           postscreen_greet_action (ignore)
                  The  action  that  postscreen(8) takes when an SMTP
                  client speaks before its turn within the time spec-
                  ified with the postscreen_greet_wait parameter.

           postscreen_greet_banner ($smtpd_banner)
                  The  text  in  the  optional  "220-text..."  server
                  response that postscreen(8) sends ahead of the real
                  Postfix SMTP server's "220 text..." response, in an
                  attempt to confuse bad SMTP clients  so  that  they
                  speak before their turn (pre-greet).

           postscreen_greet_wait (${stress?2}${stress:6}s)
                  The amount of time that postscreen(8) will wait for
                  an SMTP client to send a command before  its  turn,
                  and  for  DNS  blocklist  lookup  results to arrive
                  (default: up to 2 seconds under  stress,  up  to  6
                  seconds otherwise).

           postscreen_helo_required ($smtpd_helo_required)
                  Require  that  a  remote  SMTP client sends HELO or
                  EHLO before commencing a MAIL transaction.

           postscreen_non_smtp_command_action (drop)
                  The action that postscreen(8) takes  when  an  SMTP
                  client  sends  non-SMTP  commands as specified with
                  the postscreen_forbidden_commands parameter.

           postscreen_non_smtp_command_enable (no)
                  Enable   "non-SMTP   command"    tests    in    the
                  postscreen(8) server.

           postscreen_pipelining_action (enforce)
                  The  action  that  postscreen(8) takes when an SMTP
                  client sends multiple commands instead  of  sending
                  one  command and waiting for the server to respond.

           postscreen_pipelining_enable (no)
                  Enable "pipelining"  SMTP  protocol  tests  in  the
                  postscreen(8) server.

           postscreen_whitelist_networks ($mynetworks)
                  Network addresses that are permanently whitelisted,
                  and that will not  be  subjected  to  postscreen(8)
                  checks.

           smtpd_service_name (smtpd)
                  The  internal  service  that postscreen(8) forwards
                  allowed connections to.

    CACHE CONTROLS
           postscreen_cache_cleanup_interval (12h)
                  The amount  of  time  between  postscreen(8)  cache
                  cleanup runs.

           postscreen_cache_map (btree:$data_directory/ps_cache)
                  Persistent  storage  for  the  postscreen(8) server
                  decisions.

           postscreen_cache_retention_time (7d)
                  The amount of time that postscreen(8) will cache an
                  expired  temporary  whitelist  entry  before  it is
                  removed.

           postscreen_bare_newline_ttl (30d)
                  The amount of time that  postscreen(8)  will  cache
                  results  from a successful "bare newline" SMTP pro-
                  tocol test.

           postscreen_dnsbl_ttl (1h)
                  The amount of time that  postscreen(8)  will  cache
                  results from a successful DNS blocklist test.

           postscreen_greet_ttl (1d)
                  The  amount  of  time that postscreen(8) will cache
                  results from a successful PREGREET test.

           postscreen_non_smtp_command_ttl (30d)
                  The amount of time that  postscreen(8)  will  cache
                  results  from  a successful "non_smtp_command" SMTP
                  protocol test.

           postscreen_pipelining_ttl (30d)
                  The amount of time that  postscreen(8)  will  cache
                  results  from a successful "pipelining" SMTP proto-
                  col test.

    RESOURCE CONTROLS
           line_length_limit (2048)
                  Upon input, long lines are chopped up  into  pieces
                  of  at  most this length; upon delivery, long lines
                  are reconstructed.

           postscreen_command_count_limit (20)
                  The limit on the total number of commands per  SMTP
                  session  for postscreen(8)'s built-in SMTP protocol
                  engine.

           postscreen_command_time_limit (${stress?10}${stress:300}s)
                  The command "read" time limit  for  postscreen(8)'s
                  built-in SMTP protocol engine.

           postscreen_post_queue_limit ($default_process_limit)
                  The  number of clients that can be waiting for ser-
                  vice from a real SMTP server process.

           postscreen_pre_queue_limit ($default_process_limit)
                  The number of non-whitelisted clients that  can  be
                  waiting  for  a  decision whether they will receive
                  service from a real SMTP server process.

           postscreen_watchdog_timeout (10s)
                  How much time a postscreen(8) process may  take  to
                  respond  to  an SMTP client command or to perform a
                  cache operation before it is terminated by a built-
                  in watchdog timer.

    MISCELLANEOUS CONTROLS
           config_directory (see 'postconf -d' output)
                  The  default  location  of  the Postfix main.cf and
                  master.cf configuration files.

           delay_logging_resolution_limit (2)
                  The maximal number  of  digits  after  the  decimal
                  point when logging sub-second delay values.

           command_directory (see 'postconf -d' output)
                  The  location  of  all  postfix administrative com-
                  mands.

           ipc_timeout (3600s)
                  The time limit for sending or receiving information
                  over an internal communication channel.

           max_idle (100s)
                  The  maximum  amount  of  time that an idle Postfix
                  daemon process waits  for  an  incoming  connection
                  before terminating voluntarily.

           process_id (read-only)
                  The  process  ID  of  a  Postfix  command or daemon
                  process.

           process_name (read-only)
                  The process name of a  Postfix  command  or  daemon
                  process.

           syslog_facility (mail)
                  The syslog facility of Postfix logging.

           syslog_name (see 'postconf -d' output)
                  The  mail  system  name  that  is  prepended to the
                  process name in syslog  records,  so  that  "smtpd"
                  becomes, for example, "postfix/smtpd".

    SEE ALSO
           smtpd(8), Postfix SMTP server
           dnsblog(8), temporary DNS helper
           syslogd(8), system logging

    README FILES
           POSTSCREEN_README, Postfix Postscreen Howto

    LICENSE
           The Secure Mailer license must be  distributed  with  this
           software.

    HISTORY
           Many  ideas in postscreen(8) were explored in earlier work
           by Michael Tokarev, in OpenBSD spamd, and in  MailChannels
           Traffic Control.

    AUTHOR(S)
           Wietse Venema
           IBM T.J. Watson Research
           P.O. Box 704
           Yorktown Heights, NY 10598, USA

                                                                     POSTSCREEN(8)